User Administration

Users and Groups

Note: The Unity user interface does not currently have a GUI method to modify user and group settings. For an introduction to managing users and groups from the CLI (command-line interface) see the Ubuntu Server Guide and this brief tutorial.

Manage Users and Groups with the Gnome2 GUI

Gnome2 (the user interface for older versions of Ubuntu) included a GUI for managing users and groups. That Users and Group Management Tool from Gnome2 can be installed as part of Gnome System Tools:

sudo apt-get install gnome-system-tools

You can then launch it from Unity Dash, by pressing ALT+F2, or by creating a menu item with the command:

It is quite often necessary to have extra privileges to do certain tasks. These privileges are assigned to your user by belonging to certain groups. The tasks are allowed to be performed by any user belonging to the group associated with that task.

Example: a "sudoer" is a user who can perform certain administrative tasks, such as updating the system. To become a "sudoer" a user must belong to the "sudo" group.

To become an administrator, you must belong to the adm, admin, and sudo groups.
To be a virtualbox user, you must belong to the virtualbox group. To change printer settings you must belong to lpadmin. To use the cdrom, you must belong to cdrom. To use hot-pluggable devices, you must belong to plugdev. To share Samba folders (on a Windows-based network), you must belong to sambashare. To access NTFS files using the virtual filesystem fuse, you must belong to the fuse group. To use many games, you must belong to the games group. The list is long, and not always obvious.

Unfortunately, while this is the feature that gives Linux such a high-level of security, it can also take diligence to remember to add your user to certain groups. It is not uncommon for programs and functions on your system not to work merely because you don't have privileges to do so because you forgot to add your user to the appropriate group(s).

Of most importance, you must already be an administrator in order to change membership in groups. Therefore, if you create a new user and intend to give that user administrative privileges (by assigning the user to the administrative groups), you must do so from your original administrator account (the one you set up at installation) or from another administrative user account.

Timekpr (Parental controls)

Timekpr is a program to track and control the computer usage of user accounts. It is available from a Launchpad PPA.

Web content filtering

DansGuardian provides web filtering capability, similar to NetNanny. It is useful for limiting objectionable content in publicly accessible workstations, or for filtering objectionable content for younger users. It integrates with ClamAV, and uses several criteria for filtering websites (which is difficult to modify). It is used with Tinyproxy (best for individual users) or the Squid proxy (best for a network server). Install:

System Administration

Automating Tasks

Cron is a system daemon that runs tasks in the background according to instructions found in a crontab file. To edit the crontab file for the current user:

crontab -e

Tasks that normally require administrative (sudo) privileges should be added to the root user's crontab:

sudo crontab -e

Add commands using the format specified here (or see the Ubuntu Community Help). The crontab command format can also be found using:

man crontab

Scheduled/automated tasks (cron events) can also be edited using the GNOME schedule GUI interface.

Menu -> System -> Administration -> Task Scheduler

If the GNOME Schedule task scheduler is not installed, install it:

sudo apt-get install gnome-schedule

Boot Menu

Login Menu settings

You can change the Login menu settings from the GUI interface:

Menu -> System -> Administration -> Login Manager

You can choose an integrated theme or select individual components of the login screen/process.

Automating bootup options

StartupManager is a GUI to manage settings for Grub (Grub Legacy), Grub 2, Usplash, and Splashy.

GRUB boot manager settings

Grub2

Raring comes with Grub2, a difficult boot manager to customize. (Grub2 is also known as grub-pc.) See the evolving instructions at the Ubuntu wiki or Ubuntu forums. In brief, some settings can be edited:

Change the default menu item

There are several ways to change the default Grub2 menu item, but only one is reliable. The menu items in Grub2 change name and position in the list with every kernel upgrade. However, if you choose the default menu item by name, you can reliably set it as the default. For example, if you wish to boot a Windows OS as the default and the Grub 2 menu lists it as Microsoft Windows 98SE Ancient Edition (on /dev/sda1) then edit /etc/default/grub:

sudo kate /etc/default/grub

and change the entry to resemble:

GRUB_DEFAULT="Microsoft Windows 98SE Ancient Edition (on /dev/sda1)"

then regenerate the Grub2 config file:

sudo update-grub

To find out the names of the menu items, use:

sudo grep menuentry /boot/grub/grub.cfg

Note: There is a bug in Grub2 v.1.99 such that if the GRUB_DEFAULT option is used, the Grub2 menu can not be entered (for manually selecting a menu item). If the default option is a non-Linux OS, there will then be no way start a Linux OS (and therefore no way to subsequently change the /etc/default/grub configuration file). Use this option with great care.

and change your password to something other than insecurecleartextpassword, or use the pbkdf2-encrypted method described here. You can then password-lock menu items as well. For detailed info see this blog.

GRUB Legacy

The older version of GRUB ("Grub Legacy") is available, for use with a boot partition, for example. Install:

sudo apt-get install grub

If you have multiple operating systems (OS) on your computer, you may be using the GRUB Legacy boot manager (in a boot partition, for example). You can edit the options for GRUB Legacy in the menu.lst configuration file. (See this detailed info.)

sudo nano /boot/grub/menu.lst

(gedit can also be used instead of nano as the text editor.)

Chainloading Grub2 from Grub Legacy

To chainload Grub2 (installed in this example with the OS in the /dev/sda7 partition) from Grub Legacy (stored in a boot partition, for example), use an entry of this format in the Grub Legacy /boot/grub/menu.lst configuration file:

Grub2 is erratic, however. In many situations I don't bother to chainload it at all. Instead, it is possible to bypass Grub2 entirely and load the OS directly using Grub Legacy (stored in a boot partition, for example) using an entry in /boot/grub/menu.lst of the format:

This method, however, requires a current core.img to have been created with grub-mkimg (part of the grub-install process). When there are substantial changes to the partition or the kernel, the core.img must be re-created by re-installing Grub2 into the OS partition (in this example /dev/sda7 corresponds to (hd0,6) ):

Protecting Grub Legacy from cracking

To add password protection, in the /boot/grub/menu.lst configuration file, uncomment (remove the hashmark) from the line:

#password topsecret

and change your password to something other than topsecret, or use the md5-encrypted method described here. You can then password-lock menu items by adding the descriptor lock below the title of any item menu.

Default Applications

In previous version of ubuntu, you could choose which program to use as your default program for a specific task.

Menu -> System -> Administration -> Default Applications

or by right-clicking on any file and choosing the "Open with Other Application..." option.

The Default Applications menu has now been removed from Ubuntu, however. For a GUI that will allow this and multiple similar Ubuntu system tweaks, install Ubuntu Tweak:

In this example, I indicated that the file system was an ntfs-3g filesystem, so did not use the auto option (which detects the filesystem automatically). I used rw to specify read/write privileges for all users, but umask=0 and umask=000 are accepted by some kernels.

Method 2:
Edit fstab:

sudo nano /etc/fstab

When Ubuntu installation finishes, it mounts all ntfs partitions automatically with ntfsprogs, adding a line similar to the following to fstab:

In this example, I have a Chinese-language Windows installation on my first partition, so I set the locale parameter (locale=zh_CN.UTF-8) so that my Chinese documents can display correctly. Setting rw (same as umask=0 or umask=000) lets me read/write the partition without sudo. gid=46 specifies that the drive will belong to the group of hot-pluggable devices (plugdev) and is not necessary unless your ntfs drive is a hot-pluggable one (such as an external USB drive). nls=utf8 is the default and is optional for most ntfs users, but there are other options for Chinese (and other specialized character-set users).

Mounting FAT32 Partitions

Follow the above instructions, but use vfat instead of ntfs-3g.

In other words, if you have made a mount point directory /mnt/WindowsFAT32 and your FAT32 drive is /dev/sda3, then edit the /etc/fstab file to include the line:

/dev/sda3 /mnt/WindowsFAT32 vfat quiet,defaults,rw 0 0

Synchronize clock to network time server

The Network Time Protocol (NTP) allows time synchronization of your computer to time servers on the Internet.To enable it: